Privacy Is an Attack Surface on Canton

On the EVM, "privacy bug" is not a category. Everything is public by construction, so leaking data is not a finding. Auditors coming to Canton often carry that blind spot with them, and it is one of the biggest mindset shifts they need to make.

Canton's defining property is sub-transaction privacy: parties see only the parts of a transaction they are entitled to see. For the first time, disclosure itself becomes part of the attack surface. In institutional finance, a confidentiality failure can be Critical because the leaked information is a counterparty identity, a notional, a price, or another commercially sensitive term.

Two facts make this sharp.

---

Leaked payloads are permanent

Stakeholders and any party legitimately informed through observers or workflow-driven disclosure can see a contract's payload. Once a party has legitimately received that information, the disclosure cannot be retroactively revoked. There is no "delete," no cleanup, no rotating the data away. From an audit perspective, the question is not "can they act on it?" but "should they have seen it at all?"

---

Divulgence is a side effect, not a choice

The obvious leak is an overly broad observer list: pricing and counterparty fields exposed to parties that only needed to know a trade's status. The fix is mechanical. Split sensitive information into separate contracts and minimize observer sets.

The subtler case is workflow-driven disclosure. A party may legitimately receive information about a contract as part of executing a workflow, even though they are not a stakeholder. For example, a settlement agent may need access to specific trade details to complete settlement, and the workflow discloses those details to them. That disclosure is part of the workflow's security design, and it deserves the same scrutiny as any authorization check.

This is where EVM instincts often fail. Receiving information about a contract does not automatically grant the authority to use that contract in future transactions or exercise rights over it. But that does not make the disclosure harmless. The confidentiality breach occurred the moment information reached a party that should not have received it. "They can't do anything with it" is not a defense if they were never meant to see it in the first place.

---

Real consequences

• Overly broad observers expose counterparty identities and pricing to parties that never needed that information.
• Poorly designed workflows disclose commercially sensitive terms to participants whose visibility was never intended.

---

The fix

Treat visibility as a first-class security property. Perform stakeholder analysis for every create, fetch, and choice - not just contract creation. Separate highly confidential fields into dedicated contracts with the smallest practical observer set, and review workflows for unintended disclosure paths, not just authorization failures.

Secure your codebase - valvessecurity.com